Residay never transmits your location history. Verifiably.

What the app does not do

• No data collection. The App Store privacy label reads "Data Not Collected". This is not a summary of a policy; it is a description of the architecture. There is no server to send anything to.
• No outbound network calls except App Store purchases and external links you choose to tap. This is enforced by a test, not a promise: a canary intercepts every network request the process can make and fails the build if the layer holding your ledger attempts one.
• No analytics and no crash-reporting SDKs.
• No precise coordinates. Locations are rounded to three decimal places — roughly 110 metres — before they are stored. Attributing a day to a country needs nothing finer, and the coarser record is less sensitive if your device is ever compromised.

What protects the data that stays

• The database is protected with iOS complete file protection and is only readable when the device is unlocked.
• An optional app lock adds Face ID in front of the ledger.
• Everything is yours to take or destroy: a single encrypted backup file, and an erase-all that wipes the database, the retained documents and the keychain flags.
• Location purpose strings say plainly what tracking is for: automatic day counting. Never anything else, never transmitted.

When a copy does move

Losing years of reconstructed history to a dropped phone is a real risk, so Residay can write your whole ledger — days, evidence, retained travel documents, settings — to a single file you save wherever you like.

That file is sealed with a key that is generated on your device and never sent anywhere. You are shown a recovery code once; it, and the device that made the file, are the only things that open it. We are not a party to any of this: there is still no Residay account and no Residay server, and if you lose the code we cannot recover the file, because we hold nothing that could.

Backing up automatically to your own iCloud is designed and not yet shipped. When it arrives it changes who stores the file, not who can read it — the encryption happens before anything leaves the device, and Residay still receives nothing.